Being able to see what is happening on the network is not only important for understanding traffic patterns and flow, but also to see where issues may be or even understand what may become a target. For example, if I am on the network, and sniffing traffic as a penetration tester, and I notice encrypted traffic going somewhere, I may try to understand what more is going on.

I could attempt MiTM on that connection to try and harvest information to verify that the user pays attention to whether the site is secure or not, or I may just try to see if the network has controls in place to even allow it. The other option is that I could just try and hijack the session. Obviously, as a penetration tester, I only want to see what I can and can't do, so I can alert the stakeholders about what needs to be improved. But, as a hacker, I wouldn&apos...